# iTerm2 x-man-page: link can run attacker commands on your Mac (CVE-2026-123014) · pwn.watch > iTerm2, the popular macOS terminal, has an argument injection bug in its x-man-page: URL handler in versions before 3.7.7beta2. Per the CVE record, percent-encoded NUL characters survive iTerm2s input sanitization and are later turned into whitespace, so a crafted link can inject extra arguments into /usr/bin/man, including -P to pick an attacker-controlled pager command that runs with the users privileges. The victim has to open the crafted URL in iTerm2, for example by clicking it in a browser where iTerm2 handles the x-man-page scheme (a browser or macOS confirmation may appear) or in terminal output. The record notes it exists because of an incomplete fix for CVE-2023-46321. The fix landed in 3.7.7beta2, and stable iTerm2 3.7.7 (built Nov 3 2026) now checks man section and page names against a character allowlist; the release notes credit vin01 for finding it. The CVE record rates it CVSS 4.0 8.7 (high). No exploitation has been reported. Page: https://pwn.watch/i/iterm2-x-man-page-argument-injection-cve-2026-123014 · generated 2026-11-05T14:39:04.572Z ## Status - Severity: high · status: live · patch: patched - Product: iTerm2 (macOS terminal) - Started: 2026-11-05 - CVEs: CVE-2026-123014 - Affected: iTerm2 before 3.7.7beta2 - Fixed in: iTerm2 3.7.7beta2; iTerm2 3.7.7 ## Follow this incident - RSS (one item per update): https://pwn.watch/i/iterm2-x-man-page-argument-injection-cve-2026-123014/feed.xml - JSON Feed: https://pwn.watch/i/iterm2-x-man-page-argument-injection-cve-2026-123014/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/iterm2-x-man-page-argument-injection-cve-2026-123014.json - This file: https://pwn.watch/i/iterm2-x-man-page-argument-injection-cve-2026-123014/llms.txt ## Updates (newest first) - 2026-11-05: CVE-2026-123014 is published: percent-encoded NUL characters let a crafted x-man-page: URL inject arguments such as -P into /usr/bin/man and run arbitrary commands, an incomplete fix for CVE-2023-46321; CVSS 4.0 8.7. (https://www.cve.org/CVERecord?id=CVE-2026-123014) - 2026-11-03: iTerm2 3.7.7 ships with a hardened x-man-page: handler: man section and page names are checked against an allowlist and URLs with disallowed characters are rejected; the release notes credit vin01 for finding the bug. (https://iterm2.com/appcasts/full_changes.txt) ## Fix brief # Security brief: iTerm2 x-man-page: link can run attacker commands on your Mac (CVE-2026-123014) Source: https://pwn.watch/i/iterm2-x-man-page-argument-injection-cve-2026-123014 · status: live · severity: high · updated Nov 5, 2026, 05:48 UTC ## Patch status **PATCHED: fixed releases exist. Upgrade to a fixed version.** ## What it is iTerm2, the popular macOS terminal, has an argument injection bug in its x-man-page: URL handler in versions before 3.7.7beta2. Per the CVE record, percent-encoded NUL characters survive iTerm2s input sanitization and are later turned into whitespace, so a crafted link can inject extra arguments into /usr/bin/man, including -P to pick an attacker-controlled pager command that runs with the users privileges. The victim has to open the crafted URL in iTerm2, for example by clicking it in a browser where iTerm2 handles the x-man-page scheme (a browser or macOS confirmation may appear) or in terminal output. The record notes it exists because of an incomplete fix for CVE-2023-46321. The fix landed in 3.7.7beta2, and stable iTerm2 3.7.7 (built Nov 3 2026) now checks man section and page names against a character allowlist; the release notes credit vin01 for finding it. The CVE record rates it CVSS 4.0 8.7 (high). No exploitation has been reported. Severity detail: Command execution as the user after opening a crafted link; CVSS 4.0 8.7 (high) per the CVE record; needs user interaction; no exploitation reported - Product: iTerm2 (macOS terminal) - CVE / advisory ids: CVE-2026-123014 ## Affected versions - iTerm2 before 3.7.7beta2 ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - iTerm2 3.7.7beta2 - iTerm2 3.7.7 After upgrading, re-run the checks above and redeploy/restart the affected services. ## Specific notes On Macs with iTerm2, update to 3.7.7 or later (iTerm2 > Check for Updates, or brew upgrade --cask iterm2), and confirm the version under iTerm2 > About iTerm2. Until updated, dont open x-man-page: links from untrusted pages or terminal output, and dont set iTerm2 as the handler for that URL scheme. ## Latest updates - Nov 5, 2026: CVE-2026-123014 is published: percent-encoded NUL characters let a crafted x-man-page: URL inject arguments such as -P into /usr/bin/man and run arbitrary commands, an incomplete fix for CVE-2023-46321; CVSS 4.0 8.7. - Nov 3, 2026: iTerm2 3.7.7 ships with a hardened x-man-page: handler: man section and page names are checked against an allowlist and URLs with disallowed characters are rejected; the release notes credit vin01 for finding the bug. ## Advisories - [CVE-2026-123014](https://www.cve.org/CVERecord?id=CVE-2026-123014) (CVE Program (MITRE)) - [iTerm2 release notes (3.7.7)](https://iterm2.com/appcasts/full_changes.txt) (iTerm2) - [iTerm2 tags (v3.7.7, v3.7.7beta2)](https://gitlab.com/gnachman/iterm2/-/tags) (iTerm2 (GitLab)) --- Machine-readable: https://pwn.watch/i/iterm2-x-man-page-argument-injection-cve-2026-123014.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.